Received: from malur.postgresql.org ([217.196.149.56])
	by arkaria.postgresql.org with esmtps
 (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256)
	(Exim 4.92)
	(envelope-from <pgsql-bugs-owner+archive@lists.postgresql.org>)
	id 1lw7ED-0000Ck-9A
	for pgsql-bugs@arkaria.postgresql.org; Wed, 23 Jun 2021 18:03:57 +0000
Received: from localhost ([127.0.0.1] helo=malur.postgresql.org)
	by malur.postgresql.org with esmtp (Exim 4.92)
	(envelope-from <pgsql-bugs-owner+archive@lists.postgresql.org>)
	id 1lw7E9-0002u2-EL
	for pgsql-bugs@arkaria.postgresql.org; Wed, 23 Jun 2021 18:03:53 +0000
Received: from makus.postgresql.org ([2001:4800:3e1:1::229])
	by malur.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256)
	(Exim 4.92)
	(envelope-from <tgl@sss.pgh.pa.us>)
	id 1lw7E9-0002ow-72
	for pgsql-bugs@lists.postgresql.org; Wed, 23 Jun 2021 18:03:53 +0000
Received: from sss.pgh.pa.us ([66.207.139.130])
	by makus.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256)
	(Exim 4.92)
	(envelope-from <tgl@sss.pgh.pa.us>)
	id 1lw7E7-0000vc-Bu
	for pgsql-bugs@lists.postgresql.org; Wed, 23 Jun 2021 18:03:52 +0000
Received: from sss1.sss.pgh.pa.us (localhost [127.0.0.1])
	by sss.pgh.pa.us (8.15.2/8.15.2) with ESMTP id 15NI3oBY2338838;
	Wed, 23 Jun 2021 14:03:50 -0400
From: Tom Lane <tgl@sss.pgh.pa.us>
To: Sudheer H R <sudheer.hr@tekenlight.com>
cc: pgsql-bugs@lists.postgresql.org
Subject: Re: Found a buffer-overflow defect in asynchronous database
 connection API PQconnectPoll
In-reply-to: <2249065.1624464160@sss.pgh.pa.us>
References: <5372B6D4-8276-42C0-B8FB-BD0918826FC3@tekenlight.com>
 <2080223.1624454678@sss.pgh.pa.us>
 <96EB194C-6EF0-4F79-A855-F28CD7DE4F95@tekenlight.com>
 <205CACC4-0EBF-4672-95F4-2E1949371FE7@tekenlight.com>
 <2081383.1624455807@sss.pgh.pa.us>
 <FD6FD3A2-4EAB-487E-9ABD-A38CE36DCAC2@tekenlight.com>
 <2081779.1624456225@sss.pgh.pa.us>
 <0988202C-570F-4919-B14E-135CCFCDB1C6@tekenlight.com>
 <B5E2F345-F186-41B3-B341-9F31429A5FBC@tekenlight.com>
 <2249065.1624464160@sss.pgh.pa.us>
Comments: In-reply-to Tom Lane <tgl@sss.pgh.pa.us>
	message dated "Wed, 23 Jun 2021 12:02:40 -0400"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <2338836.1624471430.1@sss.pgh.pa.us>
Date: Wed, 23 Jun 2021 14:03:50 -0400
Message-ID: <2338837.1624471430@sss.pgh.pa.us>
List-Id: <pgsql-bugs.lists.postgresql.org>
List-Help: <https://lists.postgresql.org/manage/>
List-Subscribe: <https://lists.postgresql.org/manage/>
List-Post: <mailto:pgsql-bugs@lists.postgresql.org>
List-Owner: <mailto:pgsql-bugs-owner@lists.postgresql.org>
List-Archive: <https://www.postgresql.org/list/pgsql-bugs>
Archived-At: 
 <https://www.postgresql.org/message-id/2338837.1624471430%40sss.pgh.pa.us>
Precedence: bulk

I wrote:
> Hmph.  I can't reproduce this on RHEL8: so far as I can tell, the string
> is physically null-terminated, and clang's address sanitizer doesn't
> complain either.  Still, given the vagueness of the spec for
> gss_display_status, it seems wise to not assume that every GSS
> implementation acts the same.

I've committed fixes to make our code rely on the returned length
field instead.  Hopefully that won't expose any new bugs in other
GSS implementations :-(

			regards, tom lane